1. Common WinDbg Commands (Thematically Grouped)
(Documents/Command Lists)

... Main extensions 14) Tracing and stepping (F10, F11) 22) Logging extension (logexts.dll) 7) Symbols 15) Call stack 8) Sources 16) Registers 1) Built-in ...

2. CrashMe Application
(Applications and Tools/General Applications)

... binaries, symbols, and sources Note: If you have an interesting situation that CrashMe doesn't cover please drop us a line or send us your code. Other CrashMe fans might be thankful for your contribution. ...

3. WinDbg. From A to Z!
(Documents/Presentations)

... "WinDbg. From A to Z!" turns out to be just as useful as WinDbg itself because it explains everything from simple things that you should know right away such as setting up symbols and the theory of command ...

4. !heap failed in windbg. Invalid type information f
(Forum/Crash Dump Analysis )

... Server 2003 SP2 x64 machine. From the following windbg log I see that loaded ntdll.dll image is incorrect and does not correspond to ntdll.pdb symbols. I have tried to specify the location to ntdll.dll ...

5. ASP hang
(Forum/Crash Dump Analysis )

... pool. The server is Windows 2003 and IIS6. Many thanks in advance. Here's the output: 0:000:x86> !analyze -v *** WARNING: symbols timestamp is wrong 0x499007dc 0x49900d5a for ntdll.dll ******************************************************************************* * ...

6. AVIStreamWrite exception.. need help !!
(Forum/User-Mode Debugging)

...  ds=0023 es=0023 fs=003b gs=0000 efl=00010286 *** ERROR: Symbol file could not be found. Defaulted to export symbols for C:\WINDOWS\system32\iccvid.dll - iccvid+0x2792: 73c02792 66a5 ...

7. Bugcheck Analysis
(Forum/Crash Dump Analysis )

... Kernel Dump File: Only registers and stack trace are available Symbol search path is: SRV*c:\windows\symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Windows 7 Kernel ...

8. Crash Dump - Analysis Error - Advice Please
(Forum/Crash Dump Analysis )

WinDbug Error – Advice Please I created a folder for Symbols located as below: C:\Windows In WinDbg I set a symbol path as below: SRV*C:\Windows\Symbols*http://msdl.microsoft.com/download/symbols/packages/WindowsVista/WindowsVista.6002.090410-1830.x86fre.Symbols.exe When ...

9. Crash location !
(Forum/Crash Dump Analysis )

... process on my local machine. I have all the correct PDBs and symbol path is set correctly. The above crash file also stated that some.dll was loaded at 012C0000. In my running instance I can see ...

10. Function offsets and return address in callstack
(Forum/User-Mode Debugging)

... 00c11465 ? Is this always rule when inspecting callstack information for a thread in windbg (assuming callstack information is valid and also correct symbols are loaded)? An example of this would be very ...

11. Help with crash dump
(Forum/Crash Dump Analysis )

...  mov esi,[eax+0x140] SYMBOL_STACK_INDEX: 0 FOLLOWUP_NAME: MachineOwner SYMBOL_NAME: nt!PsReturnProcessNonPagedPoolQuota+19 MODULE_NAME: nt IMAGE_NAME: ntoskrnl.exe DEBUG_FLR_IMAGE_TIMESTAMP: ...

12. kernel32 symbol in live kernel debug
(Forum/Symbol and Source Files )

Is it possible to load kernel32 or user32 symbol in live kernel debug? Sorry for stupid question :O ...

13. Minidump error
(Forum/Crash Dump Analysis )

...  kb FOLLOWUP_IP: hknlgi+2b3 f3a552b3 ?? ??? SYMBOL_STACK_INDEX: 5 SYMBOL_NAME: hknlgi+2b3 FOLLOWUP_NAME: MachineOwner MODULE_NAME: hknlgi IMAGE_NAME: hknlgi.sys DEBUG_FLR_IMAGE_TIMESTAMP: ...

14. ntdll.dll symbols are missing?
(Forum/Symbol and Source Files )

Hi all. I have a problem with ntdll.dll symbols. Actually, I just have no .pdb files for it, however all of pdb's are downloaded from microsoft site (I use symbol server for windbg, actually). And when ...

15. Re: break on driver load - question from kam
(Forum/Article Discussions)

Kam, In general you don't need symbols to know the entry point of a PE image. The entry point is conveniently stored to the PE header and can be read from it. Further the OS loader loads an image into ...

16. Re: kernel32 symbol in live kernel debug
(Forum/Symbol and Source Files )

... process should load kernel32.dll; applications that have a GUI also load user32.dll). Symbols are loaded into a debugger mainly for two purposes: What you are asking about somehow violates this basic ...

17. Re: ntdll.dll symbols are missing?
(Forum/Symbol and Source Files )

Oh... I've already solved the problem with windbg - I just downloaded local symbols and then gave them to symstore. It's okay now, but !peb doesn't work, neither dt _PEB or dt nt!_PEB, however lml shows ...

18. Re: Symbol not found
(Forum/Symbol and Source Files )

common people just any one try to help>>> by the way when we specify the symbol path why we have to add the "srv*" before the debug file path ? ...

19. Re: Symbol not found
(Forum/Symbol and Source Files )

Mmostafaxx, sooorry for the late reply. If it is not completely to late: Check out slides 14 and 24 at WinDbg. From A to Z! and try to set up _NT_SYMBOL_PATH so that it really points to the correct ...

20. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

... symbols from Microsoft's symbols server. We have download the symbols to an identical Stratus server and ran the livekd kernel dump successfully...even moving the symbols directory/path around at will. ...

21. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

Chris, welcome. We believe that Microsoft has configured their symbol downloads to have a unique signature per server (keying off MAC number?). Nope. The linker puts a signature (a GUID) into both ...

22. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

... the symbols on the 'open' server and test them on a test 'secure' server successfully. We now need to find out if there will be a descrepancy between Windows Server 2003 R2 sp2 and Windows Server 2003 ...

23. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

Chris, you are welcome. I hope you applied correct symbols to all your environments in the meantime. I didn't try it but I guess you ended up with two different symbol sets for Windows Server 2003 ...

24. Re: Unable to load image ntkrnlpa.exe
(Forum/Crash Dump Analysis )

There does NOT appear to be a descrepancy for the 'R2' variant. We were able to sucessfully download symbols from Microsoft Symbols Server on server A and import/utilize them on server B. The symbols ...

25. Re: Wrong display of function Names by WinDbg
(Forum/User-Mode Debugging)

JD, welcome. Whenever you see a large offset like this mydll!wrongfuncanme+0x33360 it is always a sign of missing symbols. Now strncpy is part of the CRT library and thus resides in MSVCR80.DLL ...

26. Re:Can all commands be watched with WinDbg
(Forum/General Questions)

... kernel32, and other system DLLs, you wont see function parameters or local variables for these functions. Note that MS releases only public symbols for their modules. For local variables or function ...

27. Re:Debugging minGW/GCC built DLL in Visual Studio?
(Forum/Symbol and Source Files )

... internal symbols tables. In fact the SDbgExt extension does something similar; it reads MAP files generated by a MS linker and feeds that information to WinDbg. Obviously a MAP file doesn't contain as ...

28. Re:Question about COFF deprecation
(Forum/Symbol and Source Files )

... operation system, called Xenix. This said it is obvious why PE turns out to be a derivative of the Unix COFF file format. 2) Format of debug-symbol files (COFF, CodeView, PDB) While data stored ...

29. Re:Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

... is what I would try to do: 1) put the executable "ntoskrnl.exe" to a place where WinDbg will find it. Take a look at: File (menu) -> Image File Path. If this doesn't help I would: 2) Change your symbol ...

30. Remote debugging of CrashMe with ntsd -d
(Forum/Article Discussions)

... -srcpath C:\CrashMe\ I successfull connect to it from windbg with like this : windbg -n -k com:pipe,port=\\.\pipe\com_1,reconnect -srcpath SRV*;C:\CrashMe -y c:\windows\system32;c:\windows\symbols;C:\CrashMe\debug ...

31. StackOverFlowException in .Net
(Forum/Crash Dump Analysis )

... sender, EventArgs e) { MyMethod(); } private void MyMethod() { MyMethod(); } Windbg+sos loads symbols correctly, but with analyze command I've not find references to MyMethod that caused ...

32. Symbol not found
(Forum/Symbol and Source Files )

hi every one, i have recently moved from Ms VS debugger to Windbg (which i got from win SDK ver 7) ,and i'm facing the well known beginners problem which is setting the path for the debug symbol file: here ...

33. Unable to load image ntoskrnl.exe
(Forum/Crash Dump Analysis )

... Dump File: Only registers and stack trace are available Symbol search path is: srv*;srv*c:\Symbols*http://msdl.microsoft.com/download/symbols Executable search path is: Unable to load image \WINDOWS\system32\ntoskrnl.exe, ...

34. unknown stream type 0x13 and other weird messages
(Forum/Crash Dump Analysis )

... Uptime: 5 days 13:31:23.898 Process Uptime: 3 days 17:16:45.000 Symbol search path is: C:\temp\getDebug;c:\temp\symbols;SRV*c:\temp\symbols*http://msdl.microsoft.com/download/symbols Executable search ...

35. Windbg + Crash Dump
(Forum/Crash Dump Analysis )

Hi, I've lots of question about some informations i can extract from a complete crash dump. I will be glad if someone can help me. I'm using windbg with crash dump. I set Symbol search path is: ...

36. Windbg for memory analysis using mimikatz ERROR
(Forum/Crash Dump Analysis )

... key: Compatibility prefered key: SekurLSA ======== [ERROR] [CRYPTO] Acquire keys note: the memory dmp is of lsass Is this anything to do with symbol or respective dll /system32? Kindly ...

37. windbg question
(Forum/Article Discussions)

Hi, Let's say that the driver I want to debug doesn't have symbols, so I can't use DriverEntry. !lmi 77fba431 (same problem: address not found (so name is interpreted as hex)) Also, the problem ...